Trilium Notes EUVD-2026-31173

Exploitation requires an authenticated Trilium user to open the malicious SVG attachment in their browser while logged into the same Trilium instance - the SVG must be served as a top-level document from the application origin, not embedded via an img tag in a sanitized context. The attacker must have the ability to upload or place the SVG attachment within Trilium (the exact privilege level required for this step is not confirmed by the available data and conflicts with the PR:H CVSS rating versus the description's 'unauthenticated' claim - treat this as unresolved). The backend /api/script/exec endpoint must be reachable from the application origin, which is a default condition. Exploitation is limited by the requirement for user interaction (UI:R): the attack fails if no authenticated user views the SVG. The high attack complexity (AC:H) further limits exploitation by requiring the attacker to successfully social-engineer a specific authenticated user into clicking the share link.

The CVSS 3.1 base score of 6.8 with vector AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H presents notable inconsistencies against the written description that security teams should verify before deprioritizing this finding. The description explicitly characterizes the vulnerability as enabling 'unauthenticated Remote Code Execution,' yet the CVSS vector encodes PR:H, indicating the scorer believed the attacker requires high-privilege credentials - this conflict is not explained in the available data and should be clarified with the vendor or by reviewing GHSA-p837-cxw3-m964 in detail. The AC:H designation may reflect the social engineering prerequisite (tricking an authenticated user to view the SVG), but it arguably understates ease of exploitation given that public SVG share links are a normal use case. Similarly, the impact subscores of C:L and I:L seem conservative for a vulnerability that reaches /api/script/exec and can execute arbitrary Node.js - full server compromise (C:H/I:H) is plausible; the A:H designation alone suggests the scorer acknowledged severe downstream impact. No EPSS score was available. No CISA KEV listing exists, indicating no confirmed mass exploitation. Despite the moderate CVSS score, the technical severity of the chained attack (XSS → CSRF exfiltration → server-side RCE) and the public advisory detail make this a high-priority patch for any Trilium instance with share functionality exposed to untrusted parties.

An attacker crafts an SVG file containing embedded JavaScript that, when rendered by a browser as a top-level document from the Trilium origin, issues a fetch('/') request to extract the CSRF token from the DOM and then posts that token to /api/script/exec with a Node.js payload that, for example, spawns a reverse shell or exfiltrates server credentials. The attacker uploads this SVG as an attachment within a Trilium note, generates a public share link, and distributes it via phishing or embeds it in content the target user will visit while authenticated in the same browser. No public exploit code (POC) has been confirmed in the provided intelligence, but the GitHub security advisory provides sufficient technical detail to reconstruct the chain.